xred | 4f0ca4e91d19e182852284066e7491a7e25bdd9213399ecf5f86524f9179fa65

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe
Size 6.6MB
Sample260819-v1deva1zaw
SHA256 4f0ca4e91d19e182852284066e7491a7e25bdd9213399ecf5f86524f9179fa65
MD5 d27646327609b74f5d82a6f240bcbcc4
SHA1 236d69527ce61fb280a705ef37563949e4d5adf4
SHA512 72eb08bd6e472cf8268981b74d373f3f6e85a8de7ebc9b2639451ef06d2b9334beae09f1aa37de50a1e031e0ae673fa91757fbfdc361f7290067af43e4a881e5
SSDEEP 98304:9nsmtk2awQEpw4Br93JUc8LPVWFPq8j0cKhi6j4ZgnIWP864uVnQG7Y/2blw5+W3:hLfk4R93mcZP4I6jb0uF3YGO3
TLSH
T15C660229F0C5403BD4772B7AA84A4D8BF13D75958949BA0B26F40AD8DDFA5842F033DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery execution xred persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Family: Xred
Xred is backdoor written in Delphi.
backdoor xred

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 5 IoCs

pid	Process
3700	._cache_2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe
1456	Synaptics.exe
1780	Synaptics.exe
1060	._cache_Synaptics.exe
2216	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\._cache_Synaptics.exe	Synaptics.exe
File opened for modification	C:\Windows\SysWOW64\.hmcl.json.tmp	javaw.exe
File opened for modification	C:\Windows\SysWOW64\hmcl.json	javaw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1936	cmd.exe
3316	cmd.exe
4856	cmd.exe
3156	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3444	EXCEL.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	3324	javaw.exe
Token: SeRestorePrivilege	3324	javaw.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3444	EXCEL.EXE
3444	EXCEL.EXE
3444	EXCEL.EXE
3444	EXCEL.EXE
3324	javaw.exe
544	javaw.exe
1840	javaw.exe
3444	EXCEL.EXE

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 3700	1516	2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe	85
PID 3700 wrote to memory of 3324	3700	._cache_2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe	86
PID 1516 wrote to memory of 1456	1516	2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe	87
PID 3324 wrote to memory of 1872	3324	javaw.exe	90
PID 1456 wrote to memory of 1060	1456	Synaptics.exe	92
PID 1060 wrote to memory of 544	1060	._cache_Synaptics.exe	93
PID 1780 wrote to memory of 2216	1780	Synaptics.exe	95
PID 2216 wrote to memory of 1840	2216	._cache_Synaptics.exe	96
PID 544 wrote to memory of 4464	544	javaw.exe	97
PID 1840 wrote to memory of 4468	1840	javaw.exe	100
PID 1840 wrote to memory of 1936	1840	javaw.exe	103
PID 1936 wrote to memory of 4728	1936	cmd.exe	105
PID 1840 wrote to memory of 3316	1840	javaw.exe	106
PID 3316 wrote to memory of 4712	3316	cmd.exe	108
PID 1840 wrote to memory of 4856	1840	javaw.exe	109
PID 4856 wrote to memory of 2848	4856	cmd.exe	111
PID 1840 wrote to memory of 3156	1840	javaw.exe	112
PID 3156 wrote to memory of 4480	3156	cmd.exe	114
PID 1840 wrote to memory of 1080	1840	javaw.exe	115

C:\Users\Admin\AppData\Local\Temp\2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe
  "C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Program Files\Java\jdk-1.8\bin\javaw.exe
    "C:\Program Files\Java\jdk-1.8\bin\javaw.exe" -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=15 -jar "._cache_2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd ver
      4⤵
      PID:1872
- C:\ProgramData\Synaptics\Synaptics.exe
  "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Program Files\Java\jdk-1.8\bin\javaw.exe
      "C:\Program Files\Java\jdk-1.8\bin\javaw.exe" -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=15 -jar "._cache_Synaptics.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:544
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd ver
        5⤵
        
        PID:4464

C:\ProgramData\Synaptics\Synaptics.exe
C:\ProgramData\Synaptics\Synaptics.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\._cache_Synaptics.exe
  "C:\Windows\system32\._cache_Synaptics.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Program Files\Java\jdk-1.8\bin\javaw.exe
    "C:\Program Files\Java\jdk-1.8\bin\javaw.exe" -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=15 -jar "._cache_Synaptics.exe"
    3⤵
    - Drops file in System32 directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1840
  - - C:\Windows\SysWOW64\cmd.exe
      cmd ver
      4⤵
      System Location Discovery: System Language Discovery
      PID:4468
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\\"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1936
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Runtime Environment\\"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4728
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\\"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3316
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\\"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c reg query HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\JRE\
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4856
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\JRE\
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2848
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c reg query HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\JDK\
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3156
    - - C:\Windows\SysWOW64\reg.exe
        
        reg query HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\JDK\
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4480
  - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\java.exe
      "C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\java.exe" -XshowSettings:properties -version
      4⤵
      PID:1080

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

905ebba3a8fc8cc.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp
Size 50B
SHA256 9f9b26c1d0813ba85f48d71cf603c12ea47c941f23df2058d7d55d6596339807
MD5 89d95d45f974739125748c27795c26a7
SHA1 f2ae3833013af33fa585ada68ac5ba1a261d3ee9
SHA512 968aef22c3ebedcc611aab447ba2ce779c89f438075393aba0d309c4665bd87761e7a7e2a073d55ea214e26f692e35bbaf710f9e7d636a8c43d60e7a1cb4bc86
TLSH
T17B9002B49C04C541705211801B00A456179D585A255D0919D249974BD8D05209915960
MD5 SHA1 SHA512 TLSH

Submit Download

905ebba3a8fc8cc.timestamp

Path C:\ProgramData\Oracle\Java\.oracle_jre_usage\905ebba3a8fc8cc.timestamp
Size 50B
SHA256 1df573c1c03be6240660ad33a68660052851ecde477204488013220aa46e0c8c
MD5 d456bc1a5a93e0e56a586dd815bd4af6
SHA1 cccdeba4005bb12c0f08f9eef9ea709fed1ff7e3
SHA512 c647e16d48e5206c42b7018f6ed61bc6b8cce9dbeb21d6b85a6481b7a8d4875a52dba9526fe8457830c7fdf7328c613f9f1b405323516cc5786c8c03e404a175
TLSH
T19D9002B48C04C585745511852B20B456139A8849155D05299249574BD9905305515960
MD5 SHA1 SHA512 TLSH

Submit Download

Synaptics.exe

Path C:\ProgramData\Synaptics\Synaptics.exe
Size 6.6MB
SHA256 4f0ca4e91d19e182852284066e7491a7e25bdd9213399ecf5f86524f9179fa65
MD5 d27646327609b74f5d82a6f240bcbcc4
SHA1 236d69527ce61fb280a705ef37563949e4d5adf4
SHA512 72eb08bd6e472cf8268981b74d373f3f6e85a8de7ebc9b2639451ef06d2b9334beae09f1aa37de50a1e031e0ae673fa91757fbfdc361f7290067af43e4a881e5
SSDEEP 98304:9nsmtk2awQEpw4Br93JUc8LPVWFPq8j0cKhi6j4ZgnIWP864uVnQG7Y/2blw5+W3:hLfk4R93mcZP4I6jb0uF3YGO3
TLSH
T15C660229F0C5403BD4772B7AA84A4D8BF13D75958949BA0B26F40AD8DDFA5842F033DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

._cache_2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe

Path C:\Users\Admin\AppData\Local\Temp\._cache_2026-08-19_d27646327609b74f5d82a6f240bcbcc4_amadey_dark-comet_darkgate_elex_gcleaner_glassworm_hellokitty_poet-rat.exe
Size 5.8MB
SHA256 0cb3e0e9dafa46587967ac2b6ef0fb54cb3796e804094575b00c44d92fc0dc63
MD5 c07e1d93bec9f339468e1447def5fc93
SHA1 0fbc87d471ac852aaa88ccc2023edbfc64f05cfb
SHA512 c5c19fd37585269fb442fc65b4b7e7106f275a647216d4cd359005e68d9fe5e4733a84ebf4ed1522213f829476db63ecd9254627f28b0baf80a11832551685e2
SSDEEP 98304:hQEpw4Br93JUc8LPVWFPq8j0cKhi6j4ZgnIWP864uVnQG7Y/2blw5+Ww:hk4R93mcZP4I6jb0uF3YGOw
TLSH
T1A9560229F4CA112BE87B3BB6E44A4C4BF2797099C049BB0751B506D4E9FB9942B033DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.hmcl.json.tmp

Path C:\Users\Admin\AppData\Local\Temp\.hmcl.json.tmp
Size 804B
SHA256 8c9f6f3c6d1ae823b34b97e4c078181b36019106772391f5708df4bf1a53e475
MD5 2592517930e8be6a990f9f3566b56875
SHA1 4a20e46a302e7a0ce6d8273aab8fd95f48e1e94c
SHA512 459adaeaffcc7c879929e0417e303d594c2a8b77ee4b08602723c195b39c19e5e522dce2ceb2b4d74fc0c836a57c6cd4b708dac0b198759f8b459cb099774384
TLSH
T1EA01B872E525C83B75E92B7058BC82031360DE1B91893C099F37564C6F6EA7B653324B
MD5 SHA1 SHA512 TLSH

Submit Download

Z7fFnb6u.xlsm

Path C:\Users\Admin\AppData\Local\Temp\Z7fFnb6u.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
TLSH
T15482B009E788FC53D03B503E442E18B5270D7186724BDA0C384A365A66DA79F47AF6CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hmcl.json

Path C:\Users\Admin\AppData\Local\Temp\hmcl.json
Size 797B
SHA256 9302cbf9efc990e8f09f4faa01e503d8fd3e2a125926e7ce49c54aa3ad49c2f6
MD5 fcbd1c0757fcedff28bc8140f5bc3bfa
SHA1 01696e1e3f728b28fc460e85d096e2820c54dcbc
SHA512 19278ffbf1deb000db7a1d13785b89fa6885f0e25c4bc135e214e9898336b36e1a39bcefea44e9db639ab99923d0d0d4cc34b596ec765b62d767853033f9ca74
TLSH
T14501B872E525C83B75E92B7058BC82031360DE1B51893C099F375A4C6F6EA7B653324B
MD5 SHA1 SHA512 TLSH

Submit Download

hmcl.json

Path C:\Users\Admin\AppData\Local\Temp\hmcl.json
Size 798B
SHA256 50fb8e5a5d4d9f8862c2f07d2c5472232c11459288bb6392b2b63f158e694853
MD5 417405730e093a1a451b3a2aa90f5c67
SHA1 fdf76eb5a87bb22e1371de7f6ceae003bb791d6e
SHA512 10095fcc0941af497928d446aed0cc0e3daeefb3576566f33ff9b3e7e01b24426668d9f667bdac0eda06a18fde1026d331aa24332b3eb72bc45d0c5ef1d297b5
TLSH
T15801B872E511C87B75E92B7098BC82031360DE1B51893C099F375A4C6F6EA7B653228B
MD5 SHA1 SHA512 TLSH

Submit Download

authlib-injector.jar

Path C:\Users\Admin\AppData\Roaming\.hmcl\authlib-injector.jar
Size 341KB
SHA256 9c7f4343e6c82034958ffb48c14a2cb0c85928be7283103ce17da00c6d5a7b10
MD5 aa24306634e71df67b64959911bf566d
SHA1 0e0e66d8a4f91a26f33b9c09f5cdffce4a11f0b8
SHA512 080cdb4868c45f9767fe1dd9717e62a7ecea1bc0655e5ea43edadc75ed578e5addd9527047a72699b022276c668ec54d4f48b637e8110d7cbd382ec0ef48463c
SSDEEP 6144:VOT849rImMSOwq/9PMIKOVgau5zeMlw2xtaE6lxC45ssz3M7e:VORImMSOw69P5PVgaaPl156DCgf3l
TLSH
T18574D03198D1F11BF3A7D2F4B0801A13B5B816CA998170BA2572DEFDDCE66894F4C25B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etag.json

Path C:\Users\Admin\AppData\Roaming\.minecraft\cache\etag.json
Size 320B
SHA256 9ea948e16ff64e0d1cc46307b9e3cb1d573a77525eda5ef1be8d2ce9e39a33e3
MD5 1b70c35ff75e44cca5350d86eabb7b83
SHA1 1f9ff771a1a93dbf618dc2fe749e7b73453a157d
SHA512 408d0736bbb41811105a9f62cc03b102a107d5f841f9e95afcd871ac67b7036652c58c546b5ec0043a05a086ecacb02e4fc286282f95e1bc129c8bd5c3208842
TLSH
T15CE07DBA9D9C99F7739557C4F458E88183A405070C0D2CAC339E581C1F6942F171C64F
MD5 SHA1 SHA512 TLSH

Submit Download

83aa4cc77f591dfc2374580bbd95f6ba_930c87ba-0301-45df-9148-1e0277c5c198

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-540052884-2969440504-464782435-1000\83aa4cc77f591dfc2374580bbd95f6ba_930c87ba-0301-45df-9148-1e0277c5c198
Size 45B
SHA256 11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
MD5 c8366ae350e7019aefc9d1e6e6a498c6
SHA1 5731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA512 33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd
MD5 SHA1 SHA512

Submit Download

memory/544-391-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-584-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-678-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-582-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-287-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-764-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-743-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-583-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-720-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-741-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-339-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-353-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-769-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-523-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-377-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-376-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-393-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-627-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-593-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-589-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-573-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/544-540-0x000001F358B80000-0x000001F358B81000-memory.dmp

Download

memory/1456-638-0x0000000000400000-0x0000000000A99000-memory.dmp

Download

memory/1516-1-0x00000000004A0000-0x00000000004A1000-memory.dmp

Download

memory/1516-0-0x0000000000C80000-0x0000000000C81000-memory.dmp

Download

memory/1516-129-0x0000000000400000-0x0000000000A99000-memory.dmp

Download

memory/1780-279-0x0000000000400000-0x0000000000A99000-memory.dmp

Download

memory/1840-751-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-520-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-502-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-516-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-530-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-532-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-744-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-758-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-448-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-453-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-437-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-827-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-383-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-830-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-785-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-309-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-748-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/1840-762-0x000001FA88C30000-0x000001FA88C31000-memory.dmp

Download

memory/3324-314-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-301-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-690-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-669-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-463-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-481-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-489-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-482-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-470-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-361-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-335-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-667-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-252-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3324-821-0x000001EF74170000-0x000001EF74171000-memory.dmp

Download

memory/3444-255-0x00007FFE9B2F0000-0x00007FFE9B300000-memory.dmp

Download

memory/3444-256-0x00007FFE9B2F0000-0x00007FFE9B300000-memory.dmp

Download

memory/3444-259-0x00007FFE9B2F0000-0x00007FFE9B300000-memory.dmp

Download

memory/3444-280-0x00007FFE991F0000-0x00007FFE99200000-memory.dmp

Download

memory/3444-258-0x00007FFE9B2F0000-0x00007FFE9B300000-memory.dmp

Download

memory/3444-257-0x00007FFE9B2F0000-0x00007FFE9B300000-memory.dmp

Download

memory/3444-286-0x00007FFE991F0000-0x00007FFE99200000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads